The Linux kernel IPVS estimator kthread 0 initializes with zeroed chain and tick limits until its initial calculation phase completes. If the network namespace teardown disables IPVS during this phase, the calculation function can return without setting positive limits. Consequently, the kthread continues running with zero limits, draining temporary estimators and eventually writing out-of-bounds past the ticks and tick_len arrays. The patch modifies the kthread to exit early if stopping or if IPVS is disabled, preventing the out-of-bounds write. It also manages task references to ensure proper cleanup during teardown.

This vulnerability can cause out-of-bounds memory writes in the Linux kernel's IPVS subsystem, potentially leading to kernel memory corruption or instability. No known exploits in the wild have been reported. The impact is limited to systems running the affected IPVS kernel code during network namespace teardown scenarios.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability has been resolved in the Linux kernel, so applying the official kernel updates when available is recommended. Until then, avoid scenarios that trigger network namespace teardown with IPVS enabled during the estimator calculation phase.